Business Logic Assessments: Testing Overview

Click here for Free Article

Photo by rishi on Unsplash

4.1. Injection Testing Injection testing is used to search for the following vulnerabilities:

• Cross-Site Scripting — Reflective, stored, and DOM
• SQL Injection — both error based and blind
• XML Injection — XML External entities, SOAP, and XPath
• Content Spoofing — User controlled error messages, HTML content, Excel export functionality, Flash file FlashVars, Reflected File Download
• URL Redirector Abuse — Standard redirects, login request redirects, logout request redirects, Flash file redirects
• OS Commanding — Standard injections and certain zero day exploits
• HTTP Response Splitting — CRLF injection into response headers
• LDAP Injection — Login and search functionality
• Improper Input Handling — HTTP parameter pollution, Host Header attacks
• Path Traversal — File upload, file download
• Remote File Inclusion — Server executes remote files

4.2. Inspection Testing Inspection testing is used to search for the following:

• Fingerprinting — Version information in response headers or body